| Message ID | 20180221144139.4989-1-brijesh.singh@amd.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Herbert Xu |
| Headers | show |
Brijesh Singh <brijesh.singh@amd.com> wrote: > Paulian reported the below kernel crash on Ryzen 5 system: > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000073 > RIP: 0010:.LC0+0x41f/0xa00 > RSP: 0018:ffffa9968003bdd0 EFLAGS: 00010002 > RAX: ffffffffb113b130 RBX: 0000000000000000 RCX: 00000000000005a7 > RDX: 00000000000000ff RSI: ffff8b46dee651a0 RDI: ffffffffb1bd617c > RBP: 0000000000000246 R08: 00000000000251a0 R09: 0000000000000000 > R10: ffffd81f11a38200 R11: ffff8b52e8e0a161 R12: ffffffffb19db220 > R13: 0000000000000007 R14: ffffffffb17e4888 R15: 5dccd7affc30a31e > FS: 0000000000000000(0000) GS:ffff8b46dee40000(0000) knlGS:0000000000000000 > CR2: 0000000000000073 CR3: 000080128120a000 CR4: 00000000003406e0 > Call Trace: > ? sp_get_psp_master_device+0x56/0x80 > ? map_properties+0x540/0x540 > ? psp_pci_init+0x20/0xe0 > ? map_properties+0x540/0x540 > ? sp_mod_init+0x16/0x1a > ? do_one_initcall+0x4b/0x190 > ? kernel_init_freeable+0x19b/0x23c > ? rest_init+0xb0/0xb0 > ? kernel_init+0xa/0x100 > ? ret_from_fork+0x22/0x40 > > Since Ryzen does not support PSP/SEV firmware hence i->psp_data will > NULL in all sp instances. In those cases, 'i' will point to the > list head after list_for_each_entry(). Dereferencing the head will > cause kernel crash. > > Add check to call get master device only when PSP/SEV is detected. > > Reported-by: Paulian Bogdan Marinca <paulian@marinca.net> > Cc: Borislav Petkov <bp@suse.de> > Cc: Tom Lendacky <thomas.lendacky@amd.com> > CC: Gary R Hook <gary.hook@amd.com> > Cc: linux-kernel@vger.kernel.org > Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> > --- > > Changes since v1: > > v1 contained a local change I used for triggering the crash on EPYC system. > we do not need those changes in final patch. Patch applied. Thanks.
diff --git a/drivers/crypto/ccp/sp-dev.c b/drivers/crypto/ccp/sp-dev.c index eb0da6572720..e0459002eb71 100644 --- a/drivers/crypto/ccp/sp-dev.c +++ b/drivers/crypto/ccp/sp-dev.c @@ -252,12 +252,12 @@ struct sp_device *sp_get_psp_master_device(void) goto unlock; list_for_each_entry(i, &sp_units, entry) { - if (i->psp_data) + if (i->psp_data && i->get_psp_master_device) { + ret = i->get_psp_master_device(); break; + } } - if (i->get_psp_master_device) - ret = i->get_psp_master_device(); unlock: write_unlock_irqrestore(&sp_unit_lock, flags); return ret;
Paulian reported the below kernel crash on Ryzen 5 system: BUG: unable to handle kernel NULL pointer dereference at 0000000000000073 RIP: 0010:.LC0+0x41f/0xa00 RSP: 0018:ffffa9968003bdd0 EFLAGS: 00010002 RAX: ffffffffb113b130 RBX: 0000000000000000 RCX: 00000000000005a7 RDX: 00000000000000ff RSI: ffff8b46dee651a0 RDI: ffffffffb1bd617c RBP: 0000000000000246 R08: 00000000000251a0 R09: 0000000000000000 R10: ffffd81f11a38200 R11: ffff8b52e8e0a161 R12: ffffffffb19db220 R13: 0000000000000007 R14: ffffffffb17e4888 R15: 5dccd7affc30a31e FS: 0000000000000000(0000) GS:ffff8b46dee40000(0000) knlGS:0000000000000000 CR2: 0000000000000073 CR3: 000080128120a000 CR4: 00000000003406e0 Call Trace: ? sp_get_psp_master_device+0x56/0x80 ? map_properties+0x540/0x540 ? psp_pci_init+0x20/0xe0 ? map_properties+0x540/0x540 ? sp_mod_init+0x16/0x1a ? do_one_initcall+0x4b/0x190 ? kernel_init_freeable+0x19b/0x23c ? rest_init+0xb0/0xb0 ? kernel_init+0xa/0x100 ? ret_from_fork+0x22/0x40 Since Ryzen does not support PSP/SEV firmware hence i->psp_data will NULL in all sp instances. In those cases, 'i' will point to the list head after list_for_each_entry(). Dereferencing the head will cause kernel crash. Add check to call get master device only when PSP/SEV is detected. Reported-by: Paulian Bogdan Marinca <paulian@marinca.net> Cc: Borislav Petkov <bp@suse.de> Cc: Tom Lendacky <thomas.lendacky@amd.com> CC: Gary R Hook <gary.hook@amd.com> Cc: linux-kernel@vger.kernel.org Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> --- Changes since v1: v1 contained a local change I used for triggering the crash on EPYC system. we do not need those changes in final patch. drivers/crypto/ccp/sp-dev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)